@gmickel/gno 2.9.1 → 2.9.2

package/README.md

@@ -139,7 +139,7 @@ See the [guide](docs/COMPILED-CONTEXT.md).
 
 <!-- public-truth:current-version -->
 
-> Current source version: **v2.9.1**. See [CHANGELOG.md](./CHANGELOG.md).
+> Current source version: **v2.9.2**. See [CHANGELOG.md](./CHANGELOG.md).
 
 <!-- /public-truth -->
 

package/browser-extension/artifacts/gno-browser-clipper-v2.9.2.zip.sha256

@@ -0,0 +1 @@
+7073229377bafdffb9fb4834e22fe4531e68afcf615c19c1bb021c205997375a  gno-browser-clipper-v2.9.2.zip

package/browser-extension/dist/manifest.json

@@ -21,5 +21,5 @@
   "content_security_policy": {
     "extension_pages": "script-src 'self'; object-src 'none'; connect-src http://127.0.0.1:*"
   },
-  "version": "2.9.1"
+  "version": "2.9.2"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gmickel/gno",
-  "version": "2.9.1",
+  "version": "2.9.2",
   "description": "Local semantic search for your documents. Index Markdown, PDF, and Office files with hybrid BM25 + vector search.",
   "keywords": [
     "embeddings",
@@ -90,6 +90,7 @@
     "test:watcher:filesystem": "bun test test/serve/watch-service-filesystem.test.ts test/serve/resident-runtime.test.ts",
     "bench:watcher-reconciliation": "bun scripts/watcher-reconciliation-benchmark.ts",
     "bench:session-import": "bun scripts/session-import-benchmark.ts",
+    "soak": "bun scripts/soak/index.ts",
     "smoke:watcher-reconciliation": "bun scripts/watcher-reconciliation-smoke.ts",
     "bench:code-embeddings": "bun scripts/code-embedding-benchmark.ts",
     "bench:code-embeddings:write": "bun scripts/code-embedding-benchmark.ts --write",

package/spec/cli.md

@@ -1079,6 +1079,9 @@ gno embed [collection] [--collection <name>] [--force] [--model <uri>] [--batch-
 ]
 ````
 
+`updateCmdTimeoutMs` (milliseconds) appears when the collection sets a limit
+for `updateCmd`; without it the command is stopped after 10 minutes.
+
 **Exit Codes:**
 
 - 0: Success

package/spec/output-schemas/collection-list.schema.json

@@ -36,6 +36,11 @@
         "type": "string",
         "description": "Optional shell command to run before indexing"
       },
+      "updateCmdTimeoutMs": {
+        "type": "integer",
+        "minimum": 1,
+        "description": "Optional limit for updateCmd in milliseconds; gno stops the command (and anything it started) after this long. Absent means the 10 minute default."
+      },
       "languageHint": {
         "type": "string",
         "description": "BCP-47 language hint for the collection"

package/src/cli/commands/daemon.ts

@@ -10,6 +10,8 @@ import {
   EGRESS_DENIED_MESSAGE,
   EgressDeniedError,
 } from "../../core/egress-enforcement";
+import { markResidentShutdownHandlerInstalled } from "../../core/resident-shutdown-handler";
+import { sighupHandlerAllowed } from "../../core/sighup-disposition";
 import {
   DEFAULT_HTTP_GATEWAY_PORT,
   isHttpGatewayLoopbackBind,
@@ -164,6 +166,7 @@ function createSignalPromise(
       signal?.removeEventListener("abort", onAbort);
       process.off("SIGINT", onSigint);
       process.off("SIGTERM", onSigterm);
+      process.off("SIGHUP", onSighup);
       if (message && !quiet) {
         logger.log(message);
       }
@@ -174,10 +177,16 @@ function createSignalPromise(
     const onSigint = (): void => complete("Received SIGINT. Shutting down...");
     const onSigterm = (): void =>
       complete("Received SIGTERM. Shutting down...");
+    // A closed terminal or logout: shut down cleanly, as on SIGTERM, unless
+    // SIGHUP was ignored at start (nohup), which must keep working.
+    const handleSighup = sighupHandlerAllowed();
+    const onSighup = (): void => complete("Received SIGHUP. Shutting down...");
 
     signal?.addEventListener("abort", onAbort, { once: true });
     process.once("SIGINT", onSigint);
     process.once("SIGTERM", onSigterm);
+    if (handleSighup) process.once("SIGHUP", onSighup);
+    markResidentShutdownHandlerInstalled();
   });
 }
 

package/src/cli/detach.ts

@@ -510,6 +510,17 @@ function acquireStartLock(pidFile: string, kind: DetachKind): string {
   );
 }
 
+/** Take the start lock if it is free right now; null when someone holds it. */
+function tryAcquireStartLock(pidFile: string): string | null {
+  const lockPath = startLockPath(pidFile);
+  try {
+    closeSync(openSync(lockPath, "wx", 0o600));
+    return lockPath;
+  } catch {
+    return null;
+  }
+}
+
 function releaseStartLock(lockPath: string): void {
   try {
     unlinkSync(lockPath);
@@ -943,12 +954,35 @@ async function waitForExit(
 /**
  * Stop a detached process: SIGTERM → poll → SIGKILL → poll → error.
  *
- * The pid-file is **not** unlinked on success by this helper — we let the
- * target's own signal handler clean it up (see `createSignalPromise` in
- * `src/cli/commands/daemon.ts`). Callers may unlink the file as a fallback
- * when liveness is `false` after the kill sequence; `stopProcess` itself only
- * unlinks stale pid-files it discovers on entry.
+ * The target's own signal handler normally removes the pid-file. A target
+ * killed before that handler existed (SIGTERM during early startup, or the
+ * SIGKILL escalation) cannot, so once the exit is confirmed this helper
+ * removes the pid-file if it still names the pid it stopped.
+ */
+/**
+ * Remove the pid-file only if it still names `pid` (never a newer instance's).
+ * The check and the unlink run under the start lock, so a concurrent
+ * `--detach` cannot write its pid-file in between. If a start holds the lock,
+ * the file is left alone: `guardDoubleStart` already treats a dead pid as
+ * stale.
  */
+async function removePidFileIfOwnedBy(
+  pidFile: string,
+  pid: number
+): Promise<void> {
+  const lockPath = tryAcquireStartLock(pidFile);
+  if (!lockPath) return;
+  try {
+    const current = await readPidFile(pidFile).catch(() => null);
+    if (current?.pid !== pid) return;
+    await unlink(pidFile).catch(() => {
+      /* already gone */
+    });
+  } finally {
+    releaseStartLock(lockPath);
+  }
+}
+
 export async function stopProcess(options: StopOptions): Promise<StopOutcome> {
   const timeoutMs = options.timeoutMs ?? RESIDENT_STOP_GRACE_MS;
   const pollIntervalMs = options.pollIntervalMs ?? 100;
@@ -1004,6 +1038,7 @@ export async function stopProcess(options: StopOptions): Promise<StopOutcome> {
     sleep
   );
   if (exitedOnSigterm) {
+    await removePidFileIfOwnedBy(options.pidFile, payload.pid);
     return { kind: "stopped", pid: payload.pid, signal: "SIGTERM" };
   }
 
@@ -1011,6 +1046,7 @@ export async function stopProcess(options: StopOptions): Promise<StopOutcome> {
     kill(payload.pid, "SIGKILL");
   } catch (error) {
     if (isErrnoException(error) && error.code === "ESRCH") {
+      await removePidFileIfOwnedBy(options.pidFile, payload.pid);
       return { kind: "stopped", pid: payload.pid, signal: "SIGTERM" };
     }
     throw error;
@@ -1025,6 +1061,7 @@ export async function stopProcess(options: StopOptions): Promise<StopOutcome> {
     sleep
   );
   if (exitedOnSigkill) {
+    await removePidFileIfOwnedBy(options.pidFile, payload.pid);
     return { kind: "stopped", pid: payload.pid, signal: "SIGKILL" };
   }
 

package/src/cli/program.ts

@@ -25,6 +25,7 @@ import {
   formatFindingsRunStatusLine,
   readFindingsRunStatus,
 } from "../core/findings-run-state";
+import { residentShutdownHandlerInstalled } from "../core/resident-shutdown-handler";
 import { parseAndValidateTagFilter } from "../core/tags";
 import {
   formatWriteLeaseBusyJson,
@@ -5564,8 +5565,16 @@ function installPidFileCleanup(pidFile: string): void {
       // Already gone or permission-denied — nothing actionable here.
     }
   };
-  process.once("SIGINT", cleanup);
-  process.once("SIGTERM", cleanup);
+  // Registering a listener disables the default terminate action. A signal
+  // that arrives before the daemon/server installs its own shutdown handler
+  // (still starting up) would otherwise be swallowed, and `--stop` would wait
+  // out its grace period and SIGKILL. Until that handler exists, exit now.
+  const onSignal = (exitCode: number) => () => {
+    cleanup();
+    if (!residentShutdownHandlerInstalled()) process.exit(exitCode);
+  };
+  process.once("SIGINT", onSignal(130));
+  process.once("SIGTERM", onSignal(143));
   // Also run on a clean (`exit(0)`) path so crashes leave a stale pid-file
   // that `--status` can detect via liveness check, but orderly shutdown
   // (e.g. startServer returned) still cleans up.

package/src/config/types.ts

@@ -138,6 +138,9 @@ export const CollectionSchema = z.object({
   /** Optional shell command to run before indexing */
   updateCmd: z.string().optional(),
 
+  /** Kill `updateCmd` (and anything it started) after this long; default 10 min */
+  updateCmdTimeoutMs: z.number().int().positive().optional(),
+
   /** Optional BCP-47 language hint */
   languageHint: z
     .string()

package/src/core/project-profile-apply-state.ts

@@ -78,6 +78,9 @@ export function applyProjectProfileDesiredState(
     include: [],
     exclude: desired.collection.exclude,
     ...(existing?.updateCmd ? { updateCmd: existing.updateCmd } : {}),
+    ...(existing?.updateCmdTimeoutMs
+      ? { updateCmdTimeoutMs: existing.updateCmdTimeoutMs }
+      : {}),
     ...(desired.collection.languageHint
       ? { languageHint: desired.collection.languageHint }
       : existing?.languageHint

package/src/core/resident-shutdown-handler.ts

@@ -0,0 +1,23 @@
+/**
+ * Whether this process's resident (serve or daemon) has installed its own
+ * SIGINT/SIGTERM shutdown handler.
+ *
+ * A detached resident registers a pid-file cleanup listener before startup,
+ * and registering any listener disables the default terminate action. Until
+ * the resident's handler exists, that cleanup listener must exit the process
+ * itself, or a stop sent during startup is swallowed. Counting listeners
+ * cannot tell: the CLI bootstrap and the file processor add their own.
+ *
+ * @module src/core/resident-shutdown-handler
+ */
+
+let installed = false;
+
+/** Called by serve and the daemon right after registering their handlers. */
+export function markResidentShutdownHandlerInstalled(): void {
+  installed = true;
+}
+
+export function residentShutdownHandlerInstalled(): boolean {
+  return installed;
+}

package/src/core/sighup-disposition.ts

@@ -0,0 +1,66 @@
+/**
+ * Whether a resident may take over SIGHUP (fn-210).
+ *
+ * Registering any SIGHUP listener replaces the inherited disposition, so a
+ * resident started under `nohup` (or `trap '' HUP`) would start shutting down
+ * when its terminal closes. The disposition is read once with sigaction(2):
+ * if SIGHUP was ignored at start, it stays ignored. When it cannot be read
+ * (Windows, no FFI), the default is kept and no handler is installed.
+ *
+ * @module src/core/sighup-disposition
+ */
+
+const SIGHUP = 1;
+/** `SIG_IGN` is handler value 1 on Linux and macOS. */
+const SIG_IGN = 1n;
+/** Comfortably larger than `struct sigaction` on Linux and macOS. */
+const SIGACTION_BYTES = 256;
+const LIBC_NAMES: Record<string, string[]> = {
+  linux: ["libc.so.6", "libc.so"],
+  darwin: ["libc.dylib", "libSystem.B.dylib"],
+};
+
+let cached: boolean | undefined;
+
+function readSighupIgnored(): boolean | null {
+  const names = LIBC_NAMES[process.platform];
+  if (!names) return null;
+  try {
+    // bun:ffi is built into Bun (no native dependency).
+    const { dlopen, FFIType, ptr } =
+      require("bun:ffi") as typeof import("bun:ffi");
+    for (const name of names) {
+      try {
+        const libc = dlopen(name, {
+          sigaction: {
+            args: [FFIType.i32, FFIType.ptr, FFIType.ptr],
+            returns: FFIType.i32,
+          },
+        });
+        try {
+          const old = new BigUint64Array(SIGACTION_BYTES / 8);
+          if (libc.symbols.sigaction(SIGHUP, null, ptr(old)) !== 0) return null;
+          // The handler is the first member of struct sigaction on both.
+          return old[0] === SIG_IGN;
+        } finally {
+          libc.close();
+        }
+      } catch {
+        // Try the next library name.
+      }
+    }
+  } catch {
+    // No FFI in this runtime.
+  }
+  return null;
+}
+
+/**
+ * True when SIGHUP was not ignored at start and its disposition is known, so
+ * a resident can shut down gracefully on it. Read before any SIGHUP listener
+ * is installed; the answer is cached.
+ */
+export function sighupHandlerAllowed(): boolean {
+  if (cached === undefined) cached = readSighupIgnored() === false;
+  return cached;
+}

package/src/core/time-slice.ts

@@ -0,0 +1,34 @@
+/**
+ * Cooperative time slicing for long synchronous work on a resident's main
+ * thread.
+ *
+ * Bun runs SQLite synchronously, so a loop of store calls never lets the
+ * event loop serve a request until it ends, however many `await`s it
+ * contains (they resolve as microtasks). Call `maybeYield()` between units of
+ * work: once the current slice has run longer than its budget, it yields a
+ * macrotask turn so pending requests (status, search) are answered.
+ *
+ * @module src/core/time-slice
+ */
+
+/** Longest a slice runs before yielding; keeps status well under 100 ms. */
+export const DEFAULT_TIME_SLICE_MS = 20;
+
+export interface TimeSlicer {
+  /** Yield to the event loop if the current slice is over budget. */
+  maybeYield(): Promise<void>;
+}
+
+export function createTimeSlicer(
+  budgetMs = DEFAULT_TIME_SLICE_MS,
+  now: () => number = performance.now.bind(performance)
+): TimeSlicer {
+  let sliceStart = now();
+  return {
+    async maybeYield() {
+      if (now() - sliceStart < budgetMs) return;
+      await new Promise<void>((resolve) => setImmediate(resolve));
+      sliceStart = now();
+    },
+  };
+}

package/src/ingestion/graph-reconciliation.ts

@@ -19,6 +19,7 @@ import {
   normalizeWikiName,
   parseTargetParts,
 } from "../core/links";
+import { createTimeSlicer } from "../core/time-slice";
 import {
   createInMemoryWorkspaceResolver,
   membershipsFromCollectionRows,
@@ -137,6 +138,9 @@ function relationResolver(
   };
 }
 
+/** Changed identities per incoming-link lookup (one statement each). */
+const INCOMING_LINK_CHUNK = 8;
+
 export async function projectGraph(
   store: StorePort,
   options: SyncOptions,
@@ -144,6 +148,7 @@ export async function projectGraph(
   forceFull = false
 ): Promise<ProjectionError[]> {
   const errors: ProjectionError[] = [];
+  const slicer = createTimeSlicer();
   try {
     const graph = store.graphReferenceStore?.();
     let fingerprint = "";
@@ -221,10 +226,16 @@ export async function projectGraph(
       // No durable per-source link journal exists; conservatively rebuild in that case.
       if (changed.size === 0 && state.dirty) selected = undefined;
       else {
-        for (const id of graph.incomingLinkSources(
-          [...changed.values()].flat()
-        ))
-          selected.add(id);
+        // One statement over every changed identity scales with links x
+        // targets and cannot yield; chunk it so the event loop gets turns.
+        const identities = [...changed.values()].flat();
+        for (let i = 0; i < identities.length; i += INCOMING_LINK_CHUNK) {
+          await slicer.maybeYield();
+          for (const id of graph.incomingLinkSources(
+            identities.slice(i, i + INCOMING_LINK_CHUNK)
+          ))
+            selected.add(id);
+        }
         const resolveOld = relationResolver(
           previous.map((row) => row.document),
           memberships
@@ -264,7 +275,10 @@ export async function projectGraph(
       );
       if (!backfill.ok) throw new Error(backfill.error.message);
       for (const [index, doc] of targets.entries()) {
+        // Every 25 documents at least, and sooner when slow documents
+        // (large link resolution) would hold the event loop past its budget.
         if (index > 0 && index % 25 === 0) await Bun.sleep(0);
+        else await slicer.maybeYield();
         if (!doc.active) {
           const cleared = await store.setDocEdges(
             doc.id,

package/src/ingestion/sync.ts

@@ -229,11 +229,73 @@ async function gitPull(path: string): Promise<void> {
 /**
  * Run collection update command (best effort).
  */
-async function runUpdateCmd(path: string, cmd: string): Promise<void> {
+/** Default cap on a collection's updateCmd; `updateCmdTimeoutMs` overrides it. */
+export const UPDATE_CMD_TIMEOUT_MS = 10 * 60_000;
+/**
+ * POSIX wrapper run as `sh -c WRAPPER sh <updateCmd>` in a new process group
+ * (detached spawn). It runs the command with stdin from /dev/null and blocks
+ * a subshell on gno's stdin pipe: when gno exits or is killed, by any signal
+ * including SIGKILL, the pipe closes and the subshell stops the whole group,
+ * so no part of the command (a hung `git` or `rsync`) outlives gno; anything
+ * still running 5 s after SIGTERM gets SIGKILL. The pipe goes through fd 3
+ * because an asynchronous list's stdin is /dev/null.
+ */
+const UPDATE_CMD_WRAPPER = [
+  "exec 3<&0",
+  '"$0" -c "$1" </dev/null 3<&- &',
+  "cmd=$!",
+  // The watcher ignores the TERM it sends, gives the command up to 5 s to
+  // exit, then SIGKILLs whatever is left of the group (itself included).
+  [
+    "( trap '' TERM; read -r _ <&3; kill -TERM 0",
+    'i=0; while kill -0 "$cmd" 2>/dev/null && [ "$i" -lt 10 ]; do sleep 0.5; i=$((i + 1)); done',
+    "kill -KILL 0 ) &",
+  ].join("; "),
+  "exec 3<&-",
+  'wait "$cmd"',
+].join("\n");
+
+async function runUpdateCmd(
+  path: string,
+  cmd: string,
+  timeoutMs = UPDATE_CMD_TIMEOUT_MS
+): Promise<void> {
+  const posix = process.platform !== "win32";
+  let child: Bun.Subprocess<"pipe", "ignore", "ignore">;
   try {
-    await Bun.$`sh -c ${cmd}`.cwd(path).quiet().nothrow();
+    child = Bun.spawn({
+      cmd: posix
+        ? ["sh", "-c", UPDATE_CMD_WRAPPER, "sh", cmd]
+        : ["sh", "-c", cmd],
+      cwd: path,
+      stdin: "pipe",
+      stdout: "ignore",
+      stderr: "ignore",
+      detached: posix,
+    });
   } catch {
-    // Ignore update command failures
+    // Ignore update command failures (no shell, bad cwd).
+    return;
+  }
+  const signalAll = (signal: NodeJS.Signals): void => {
+    try {
+      if (posix) process.kill(-child.pid, signal);
+      else child.kill(signal);
+    } catch {
+      // already gone
+    }
+  };
+  // On timeout, TERM the group. POSIX: that ends the wrapper, the finally
+  // below closes the lifeline, and the wrapper's watcher escalates whatever
+  // ignores TERM to SIGKILL. On Windows SIGTERM already terminates.
+  const timer = setTimeout(() => signalAll("SIGTERM"), timeoutMs);
+  try {
+    // Ignore update command failures (non-zero exit, timeout).
+    await child.exited;
+  } finally {
+    clearTimeout(timer);
+    // Closing the lifeline also reaps anything the command left running.
+    await Promise.resolve(child.stdin.end()).catch(() => undefined);
   }
 }
 
@@ -1605,7 +1667,11 @@ export class SyncService {
         caller: { authenticated: true, operationAuthorized: true },
         contentClass: "source",
       });
-      await runUpdateCmd(collection.path, collection.updateCmd);
+      await runUpdateCmd(
+        collection.path,
+        collection.updateCmd,
+        collection.updateCmdTimeoutMs
+      );
     }
 
     if (options.gitPull && (await isGitRepo(collection.path))) {

package/src/serve/parent-lifeline.ts

@@ -0,0 +1,44 @@
+/**
+ * Parent lifeline for a resident started by another process (fn-207).
+ *
+ * A launcher that owns `gno serve` (the desktop shell) sets
+ * `GNO_PARENT_LIFELINE=stdin` and keeps a pipe on the child's stdin open.
+ * When the launcher exits or is killed, even with SIGKILL, the kernel closes
+ * that pipe; stdin reaches EOF and the resident shuts down as on SIGTERM.
+ * Event-driven on every platform, with no polling timer. Without the opt-in a
+ * resident keeps running when its parent goes away (e.g. `nohup gno serve`).
+ *
+ * @module src/serve/parent-lifeline
+ */
+
+export const PARENT_LIFELINE_ENV = "GNO_PARENT_LIFELINE";
+
+/**
+ * When the launcher opted in, call `onLost` once stdin reaches EOF. Returns a
+ * stop function that cancels the watch (normal shutdown). The opt-in is
+ * removed from the environment so this process's own children never inherit
+ * it.
+ */
+export function watchParentLifeline(onLost: () => void): () => void {
+  const mode = process.env[PARENT_LIFELINE_ENV];
+  delete process.env[PARENT_LIFELINE_ENV];
+  if (mode !== "stdin") return () => undefined;
+
+  let stopped = false;
+  const reader = Bun.stdin.stream().getReader();
+  void (async () => {
+    try {
+      // The launcher never writes; any bytes are drained and ignored.
+      while (!(await reader.read()).done) {
+        // keep reading until EOF
+      }
+    } catch {
+      // A read error means the pipe is gone, the same as EOF.
+    }
+    if (!stopped) onLost();
+  })();
+  return () => {
+    stopped = true;
+    void reader.cancel().catch(() => undefined);
+  };
+}

package/src/serve/resident-runtime.ts

@@ -209,6 +209,7 @@ export type ResidentRuntimeDeps = {
     callbacks?: CollectionWatchCallbacks;
     syncOptions?: Parameters<typeof withContentTypeRules>[0];
     acquireWriteLease?: () => Promise<(() => Promise<void>) | null>;
+    reconcileOnStart?: boolean;
   }) => CollectionWatchService;
   modelManagerFactory?: (config: Config) => ModelManager;
 };
@@ -392,6 +393,8 @@ export async function startResidentRuntime(
     },
     syncOptions: withContentTypeRules({}, initialConfig),
     acquireWriteLease: leaseFor(`gno ${mode} (watch sync)`),
+    // serve has no initial sync of its own; the daemon runs one unless told not to.
+    reconcileOnStart: mode === "serve",
   });
   watchService.start();
   // A backlog left by `--no-embed` or an earlier run gets a pass without
@@ -502,8 +505,24 @@ export async function startResidentRuntime(
     indexName: canonicalizeIndexName(options.index ?? DEFAULT_INDEX_NAME),
   };
   let configRefresh: Promise<void> | undefined;
+  // Every read request refreshes the config. Re-reading and re-parsing an
+  // unchanged file each time kept the main thread busy under load; skip it
+  // while the file's identity, size and times match the last good load. Any
+  // write, rename, chmod or delete changes the stamp, so a broken file is
+  // still reported, never served stale.
+  let loadedConfigStamp: string | undefined;
+  const configStamp = async (): Promise<string | undefined> => {
+    try {
+      const stat = await Bun.file(instance.configPath).stat();
+      return `${stat.ino}:${stat.size}:${stat.mtimeMs}:${stat.ctimeMs}`;
+    } catch {
+      return undefined;
+    }
+  };
   const refreshConfig = (): Promise<void> => {
     configRefresh ??= (async () => {
+      const stamp = await configStamp();
+      if (stamp !== undefined && stamp === loadedConfigStamp) return;
       const file = await readInstanceConfig(
         instance,
         deps.loadConfig ?? loadConfig
@@ -514,7 +533,10 @@ export async function startResidentRuntime(
         collections: file.collections,
         contexts: file.contexts,
       };
-      if (Bun.deepEquals(next, served)) return;
+      if (Bun.deepEquals(next, served)) {
+        loadedConfigStamp = stamp;
+        return;
+      }
       await adoptServedConfig(
         {
           ...instance,
@@ -529,6 +551,7 @@ export async function startResidentRuntime(
         },
         next
       );
+      loadedConfigStamp = stamp;
     })().finally(() => {
       configRefresh = undefined;
     });

package/src/serve/resident-shutdown.ts

@@ -16,6 +16,7 @@ import {
   SHUTDOWN_ABORT_MS,
   SHUTDOWN_EXIT_MS,
 } from "../core/shutdown-budget";
+import { killImportChildren } from "../sessions/import-child";
 
 interface ResidentShutdownResources {
   options: ResidentRuntimeOptions;
@@ -78,6 +79,9 @@ export async function disposeResidentResources(
         (error: unknown) => console.error("Resident cleanup failed:", error)
       );
   stopFindings();
+  // A session import runs in a child that would outlive this process and hold
+  // up the drain below; cutting it short is safe (one transaction per file).
+  killImportChildren();
   const schedulerDrain = observe(() =>
     scheduler.stop ? scheduler.stop() : scheduler.dispose()
   );

package/src/serve/server.ts

@@ -3,6 +3,8 @@ import type { RequestPeerServer } from "./request-locality";
 import type { ResidentRuntime } from "./resident-runtime";
 import type { ContextHolder } from "./routes/api";
 
+import { markResidentShutdownHandlerInstalled } from "../core/resident-shutdown-handler";
+import { sighupHandlerAllowed } from "../core/sighup-disposition";
 import { getActivePreset } from "../llm/registry";
 import {
   isHttpGatewayLoopbackBind,
@@ -25,6 +27,7 @@ import {
  * @module src/serve/server
  */
 import { withRemoteHostPathRedaction } from "./host-path-redaction";
+import { watchParentLifeline } from "./parent-lifeline";
 import { PDFJS_ASSET_CACHE_CONTROL } from "./pdfjs-assets";
 // HTML import - Bun handles bundling TSX/CSS automatically via routes
 import homepage from "./public/index.html";
@@ -401,7 +404,7 @@ export function loopbackHttpOrigin(host: string, port: number): string {
 
 /**
  * Start the web server.
- * Opens DB once, closes on SIGINT/SIGTERM.
+ * Opens DB once, closes on SIGINT/SIGTERM/SIGHUP.
  */
 export async function startServer(
   options: ServeOptions = {},
@@ -478,9 +481,22 @@ export async function startServer(
 
   process.once("SIGINT", shutdown);
   process.once("SIGTERM", shutdown);
+  // A closed terminal or logout: shut down cleanly, as on SIGTERM, unless
+  // SIGHUP was ignored at start (nohup), which must keep working.
+  const handleSighup = sighupHandlerAllowed();
+  if (handleSighup) process.once("SIGHUP", shutdown);
+  markResidentShutdownHandlerInstalled();
+  // A launcher that owns this process (the desktop shell) closes our stdin
+  // when it exits or is killed; shut down instead of running orphaned.
+  const stopLifeline = watchParentLifeline(() => {
+    console.log("\nParent process gone.");
+    shutdown();
+  });
   const removeShutdownHandlers = (): void => {
     process.off("SIGINT", shutdown);
     process.off("SIGTERM", shutdown);
+    if (handleSighup) process.off("SIGHUP", shutdown);
+    stopLifeline();
   };
 
   // Start server with try/catch for port-in-use etc.
@@ -1778,6 +1794,11 @@ export async function startServer(
     await dependencies.waitForShutdown(shutdownController.signal);
   } else {
     await new Promise<void>((resolve) => {
+      // The lifeline can fire while the listener is still starting.
+      if (shutdownController.signal.aborted) {
+        resolve();
+        return;
+      }
       shutdownController.signal.addEventListener("abort", () => resolve(), {
         once: true,
       });

package/src/serve/watch-reconciliation.ts

@@ -10,8 +10,13 @@
 import type { Collection } from "../config/types";
 import type { SqliteAdapter } from "../store/sqlite/adapter";
 
+import { relPathUnderAnyPrefix } from "../ingestion";
 import { WATCHER_ACTIVE_SOURCE_PATH_MAX } from "../store/types";
 import { fallbackClassifyDirtyHints } from "./watch-reconciliation-fallback";
+import {
+  fallbackFs,
+  inspectNoFollowPresence,
+} from "./watch-reconciliation-fallback-disk";
 import {
   filterEligiblePaths,
   type ClassificationResult,
@@ -48,6 +53,112 @@ export {
   type WatcherEventClassification,
 } from "./watch-reconciliation-shared";
 
+type StoreOnlyRemovals =
+  | { status: "ok"; paths: string[] }
+  | { status: "overflow" }
+  | { status: "error"; cause: unknown; stage: "scan" | "store" };
+
+/**
+ * Store-known active paths under the dirty hints that are gone from disk.
+ * The snapshot only knows what it scanned: a note indexed from its own exact
+ * event after the baseline is in the store but not the snapshot, and when
+ * its directory is then moved or replaced (one directory event) the snapshot
+ * diff alone would leave it active (fn-209).
+ *
+ * A path the fresh snapshot lists as a file or symlink is present. Paths in
+ * subtrees the snapshot left unproven are left alone. Every other path gets
+ * the fallback classifier's no-follow, availability-aware proof: missing or
+ * no longer a regular source is a removal; an inconclusive check is a scan
+ * error, so the watcher keeps the work and retries rather than infer a
+ * delete. The root hint (a watcher event without a filename) uses the
+ * bounded whole-collection inventory.
+ */
+async function storeOnlyRemovals(options: {
+  store: SqliteAdapter;
+  collection: Collection;
+  rootAbs: string;
+  dirtyHints: readonly string[];
+  next: WatcherSnapshot | null;
+  sourcePathMax: number;
+  snapshotOptions?: WatcherSnapshotOptions;
+}): Promise<StoreOnlyRemovals> {
+  const { store, collection, rootAbs, next, sourcePathMax } = options;
+  const hints = [...new Set(options.dirtyHints)].sort();
+  const storePaths: string[] = [];
+  if (hints.includes("")) {
+    if (typeof store.listActiveSourcePaths !== "function") {
+      return { status: "ok", paths: [] };
+    }
+    const listed = await store.listActiveSourcePaths(
+      collection.name,
+      sourcePathMax
+    );
+    if (!listed.ok) {
+      if (listed.error.code === "OVERFLOW") return { status: "overflow" };
+      return {
+        status: "error",
+        cause: new Error(listed.error.message),
+        stage: "store",
+      };
+    }
+    storePaths.push(...listed.value);
+  } else {
+    if (typeof store.listActiveDescendantSourcePaths !== "function") {
+      return { status: "ok", paths: [] };
+    }
+    // A hint under another hint is covered by the outer descendant lookup.
+    const roots = hints.filter(
+      (hint, index) =>
+        !hints.slice(0, index).some((outer) => hint.startsWith(`${outer}/`))
+    );
+    for (const dir of roots) {
+      const listed = await store.listActiveDescendantSourcePaths(
+        collection.name,
+        dir,
+        Math.max(1, sourcePathMax - storePaths.length)
+      );
+      if (!listed.ok) {
+        if (listed.error.code === "OVERFLOW") return { status: "overflow" };
+        // Not a directory path the store can scope (e.g. escapes the root).
+        if (listed.error.code === "INVALID_INPUT") continue;
+        return {
+          status: "error",
+          cause: new Error(listed.error.message),
+          stage: "store",
+        };
+      }
+      storePaths.push(...listed.value);
+      if (storePaths.length > sourcePathMax) return { status: "overflow" };
+    }
+  }
+
+  const unproven = [...(next?.unprovenSubtrees ?? [])];
+  const fs = options.snapshotOptions?.fs ?? fallbackFs();
+  const removals: string[] = [];
+  for (const path of storePaths) {
+    if (relPathUnderAnyPrefix(path, unproven)) continue;
+    const slash = path.lastIndexOf("/");
+    const parent = slash === -1 ? "" : path.slice(0, slash);
+    const kind = next?.directories
+      .get(parent)
+      ?.get(path.slice(slash + 1))?.kind;
+    if (kind === "file" || kind === "symlink") continue;
+    const presence = await inspectNoFollowPresence(
+      rootAbs,
+      path,
+      fs,
+      options.snapshotOptions?.directoryAvailability
+    );
+    if (presence.status === "error") {
+      return { status: "error", cause: presence.cause, stage: "scan" };
+    }
+    if (presence.status === "missing" || !presence.indexable) {
+      removals.push(path);
+    }
+  }
+  return { status: "ok", paths: removals };
+}
+
 /**
  * Snapshot-first classification of dirty hints. On overflow/scan/metadata
  * failure, uses bounded store + disk enumeration without inferring deletes
@@ -96,10 +207,32 @@ export async function classifyDirtyHints(options: {
       snapshotOptions
     );
     if (diff.status === "ok") {
+      const storeRemovals = await storeOnlyRemovals({
+        store,
+        collection,
+        rootAbs,
+        dirtyHints,
+        next: diff.nextSnapshot,
+        sourcePathMax,
+        snapshotOptions,
+      });
+      if (storeRemovals.status === "overflow") {
+        return { status: "full_reconcile", reason: "budget_overflow" };
+      }
+      if (storeRemovals.status === "error") {
+        return {
+          status: "error",
+          cause: storeRemovals.cause,
+          stage: storeRemovals.stage,
+        };
+      }
       return {
         status: "ok",
         candidates: filterEligiblePaths(diff.candidates, collection),
-        removals: filterEligiblePaths(diff.removals, collection),
+        removals: filterEligiblePaths(
+          [...new Set([...diff.removals, ...storeRemovals.paths])],
+          collection
+        ),
         nextSnapshot: diff.nextSnapshot,
         usedFallback: false,
       };

package/src/serve/watch-service-flush-generation.ts

@@ -7,18 +7,65 @@
 // node:path — Bun has no path utilities
 import { normalize } from "node:path";
 
+import type { CollectionSyncResult } from "../ingestion";
 import type {
   FlushCollectionInput,
   FlushCollectionOutcome,
 } from "./watch-service-flush";
 
-import { defaultSyncService } from "../ingestion";
+import { defaultSyncService, isSourceAvailabilitySkip } from "../ingestion";
 import { hasFileLevelSyncError } from "./watch-reconciliation";
 import {
   contentChangedPaths,
   notifyCompletedSync,
 } from "./watch-service-flush-helpers";
 
+/** Failure codes from the store side of a sync: transient, worth a retry. */
+const STORE_SIDE_FAILURE_CODES = new Set(["QUERY_FAILED", "STORE_ERROR"]);
+const SOURCE_AVAILABILITY_PREFIX = "SOURCE_AVAILABILITY_";
+
+interface ReconcileFailures {
+  /** A collection-level failure (no path): the reconcile itself is incomplete. */
+  unscoped: boolean;
+  /** Every named failed path, from file receipts and walker errors alike. */
+  named: string[];
+  /** Named paths that failed in the store, not on the file's content. */
+  storeSide: string[];
+}
+
+/** Classify the failures of a completed full-collection sync. */
+function classifyReconcileFailures(
+  result: CollectionSyncResult
+): ReconcileFailures {
+  const named = new Set<string>();
+  const storeSide = new Set<string>();
+  let unscoped = false;
+  for (const file of result.files ?? []) {
+    if (file.status !== "error") continue;
+    named.add(file.relPath);
+    if (STORE_SIDE_FAILURE_CODES.has(file.errorCode ?? ""))
+      storeSide.add(file.relPath);
+  }
+  // A collection whose source availability cannot be proven fails the same
+  // way on every attempt until its config or volume changes (a config edit
+  // starts a new reconcile): record it once, like a content failure.
+  let unavailable = false;
+  // Walker failures (TOO_LARGE, PERMISSION...) appear only here.
+  for (const entry of result.errors) {
+    if (isSourceAvailabilitySkip(entry.code)) continue;
+    if (!entry.relPath) {
+      if (entry.code.startsWith(SOURCE_AVAILABILITY_PREFIX)) unavailable = true;
+      else unscoped = true;
+      continue;
+    }
+    named.add(entry.relPath);
+    if (STORE_SIDE_FAILURE_CODES.has(entry.code)) storeSide.add(entry.relPath);
+  }
+  // A failure count with nothing named is collection-level too.
+  if (named.size === 0 && !unavailable) unscoped = true;
+  return { unscoped, named: [...named], storeSide: [...storeSide] };
+}
+
 /**
  * When collection generation advanced during/before flush, run full
  * syncCollection. Failures leave durable generation work and never advance
@@ -96,11 +143,38 @@ export async function runGenerationReconcile(
         contentChangedPaths(result);
 
       if (hasFileLevelSyncError(result)) {
-        // Notify completed sync once; keep durable generation work.
-        notifyCompletedSync(input, operationPaths, result, ownership);
         const error = new Error(
           "One or more paths failed during watcher generation reconcile"
         );
+        const failures = classifyReconcileFailures(result);
+        // The walk completed: the collection is reconciled except for the
+        // named failed paths (fn-211). Requeuing the whole generation
+        // re-walked the collection every backoff step for as long as one file
+        // kept failing. Store-side failures are transient and can leave a
+        // stale document, so only those paths are retried (exact paths,
+        // failure backoff). Content failures (unreadable, corrupt, too
+        // large...) are recorded once, as `gno update` and the daemon's
+        // initial sync do; the next edit to the file retries it. Keep the
+        // whole generation when any failure is collection-level (e.g. the
+        // document inventory failed) or this flush no longer owns the
+        // collection (its requeue would be dropped).
+        if (
+          !failures.unscoped &&
+          input.getCurrentGeneration() === input.ownerGeneration
+        ) {
+          input.invalidateSnapshot(stillCurrent);
+          notifyCompletedSync(input, operationPaths, result, ownership);
+          input.onSyncError(failures.named, error);
+          if (failures.storeSide.length > 0) {
+            input.requeue(failures.storeSide, []);
+            return { status: "failed", error };
+          }
+          completedGeneration = currentGeneration;
+          needsWork = input.getCurrentGeneration() !== completedGeneration;
+          continue;
+        }
+        // Notify completed sync once; keep durable generation work.
+        notifyCompletedSync(input, operationPaths, result, ownership);
         input.onSyncError([], error);
         input.requeueGeneration();
         return { status: "failed", error };

package/src/serve/watch-service.ts

@@ -49,7 +49,11 @@ import {
 } from "./watch-service-lifecycle";
 import { runOwnedCollectionFlush } from "./watch-service-run-flush";
 import { beginSnapshotInit } from "./watch-service-snapshot";
-import { pendingHasWork, type CollectionPending } from "./watch-service-state";
+import {
+  emptyPending,
+  pendingHasWork,
+  type CollectionPending,
+} from "./watch-service-state";
 
 export interface CollectionWatchState {
   expectedCollections: string[];
@@ -111,6 +115,12 @@ interface CollectionWatchServiceOptions {
   snapshotEntryCeiling?: number;
   /** Shared writer lease taken (no wait) around each flush's writes. */
   acquireWriteLease?: () => Promise<(() => Promise<void>) | null>;
+  /**
+   * Queue a full reconcile of every watched collection at start, so changes
+   * made while no resident ran reach the index. Off for the daemon, whose
+   * initial sync (unless --no-sync-on-start) covers the same ground.
+   */
+  reconcileOnStart?: boolean;
 }
 
 export class CollectionWatchService {
@@ -152,6 +162,7 @@ export class CollectionWatchService {
   readonly #snapshotFs: WatcherSnapshotFs | undefined;
   readonly #snapshotEntryCeiling: number | undefined;
   readonly #acquireWriteLease: CollectionWatchServiceOptions["acquireWriteLease"];
+  readonly #reconcileOnStart: boolean;
   #nextCollectionGeneration = 0;
   #disposed = false;
   #lastEventAt: string | null = null;
@@ -176,11 +187,24 @@ export class CollectionWatchService {
     this.#snapshotFs = options.snapshotFs;
     this.#snapshotEntryCeiling = options.snapshotEntryCeiling;
     this.#acquireWriteLease = options.acquireWriteLease;
+    this.#reconcileOnStart = options.reconcileOnStart ?? false;
   }
 
   start(): void {
-    if (!this.#disposed) {
-      this.updateCollections(this.#collections);
+    if (this.#disposed) {
+      return;
+    }
+    this.updateCollections(this.#collections);
+    if (!this.#reconcileOnStart) {
+      return;
+    }
+    // Generation work waits for the snapshot baseline, then runs a full
+    // syncCollection through the normal flush path (write lease, failure
+    // backoff, source availability). Unwatchable collections queue nothing.
+    for (const name of this.#watchers.keys()) {
+      const pending = this.#pendingByCollection.get(name) ?? emptyPending();
+      pending.generationReconcile = true;
+      this.#pendingByCollection.set(name, pending);
     }
   }
 

package/src/sessions/import-child.ts

@@ -9,8 +9,11 @@
  * store connection: the archive import lock, receipts and error codes are
  * unchanged.
  *
- * The child reads one request from stdin and writes one JSON result line to
- * stdout. The request carries the caller's loaded config: the child opens
+ * The child reads one request line from stdin and writes one JSON result line
+ * to stdout. The parent keeps stdin open for the child's lifetime: EOF means
+ * the parent died, and the child exits instead of importing on as an orphan.
+ * A resident kills its import children when it shuts down, and every import
+ * has a timeout. The request carries the caller's loaded config: the child opens
  * the index without syncing any config into it and imports with exactly the
  * config the server holds. From source the child runs this module; a
  * compiled executable re-runs itself with `IMPORT_CHILD_ENV` set, which the
@@ -87,12 +90,24 @@ async function importInThisProcess(
   }
 }
 
+/** Longest a single import may run before its child is killed. */
+export const SESSION_IMPORT_TIMEOUT_MS = 30 * 60_000;
+
+/** Import children still running in this process. */
+const liveChildren = new Set<Bun.Subprocess>();
+
+/** Kill every running import child (resident shutdown). */
+export function killImportChildren(): void {
+  for (const child of liveChildren) child.kill("SIGKILL");
+}
+
 /**
  * Import a registered source without blocking the caller's event loop.
  * Throws a `SessionsError` for typed failures and a plain `Error` otherwise.
  */
 export async function importInChildProcess(
-  request: ImportChildRequest
+  request: ImportChildRequest,
+  options: { timeoutMs?: number } = {}
 ): Promise<SessionImportReceipt> {
   // A compiled executable cannot run an external TS entry: it re-runs itself.
   // Shared check: covers the POSIX `/$bunfs/` and Windows `B:/~BUN/` roots.
@@ -100,15 +115,38 @@ export async function importInChildProcess(
   const child = Bun.spawn({
     cmd: compiled ? [process.execPath] : [process.execPath, import.meta.path],
     env: compiled ? { ...process.env, [IMPORT_CHILD_ENV]: "1" } : process.env,
-    stdin: new Blob([JSON.stringify(request)]),
+    // The request line, then held open as the child's lifeline.
+    stdin: "pipe",
     stdout: "pipe",
     stderr: "pipe",
   });
-  const [stdout, stderr, exitCode] = await Promise.all([
-    new Response(child.stdout).text(),
-    new Response(child.stderr).text(),
-    child.exited,
-  ]);
+  liveChildren.add(child);
+  const timeoutMs = options.timeoutMs ?? SESSION_IMPORT_TIMEOUT_MS;
+  let timedOut = false;
+  const timer = setTimeout(() => {
+    timedOut = true;
+    child.kill("SIGKILL");
+  }, timeoutMs);
+  let output: [string, string, number];
+  try {
+    void child.stdin.write(`${JSON.stringify(request)}\n`);
+    void child.stdin.flush();
+    output = await Promise.all([
+      new Response(child.stdout).text(),
+      new Response(child.stderr).text(),
+      child.exited,
+    ]);
+  } finally {
+    clearTimeout(timer);
+    liveChildren.delete(child);
+    void Promise.resolve(child.stdin.end()).catch(() => undefined);
+  }
+  const [stdout, stderr, exitCode] = output;
+  if (timedOut) {
+    throw new Error(
+      `session import timed out after ${Math.round(timeoutMs / 1000)} s`
+    );
+  }
   const line = stdout.trim().split("\n").at(-1) ?? "";
   let result: ImportChildResult | null = null;
   try {
@@ -126,15 +164,43 @@ export async function importInChildProcess(
   throw new Error(result.message);
 }
 
-/** Child entry: one request on stdin, one JSON result line on stdout. */
+/** Read the request line; afterwards stdin is only the lifeline. */
+async function readRequestLine(
+  reader: ReadableStreamDefaultReader<Uint8Array>
+): Promise<string> {
+  const decoder = new TextDecoder();
+  let text = "";
+  while (!text.includes("\n")) {
+    const chunk = await reader.read();
+    if (chunk.done) break;
+    text += decoder.decode(chunk.value, { stream: true });
+  }
+  return text.split("\n")[0] ?? "";
+}
+
+/** Child entry: one request line on stdin, one JSON result line on stdout. */
 export async function runImportChild(): Promise<void> {
   // Nothing this child starts may re-enter child mode.
   delete process.env[IMPORT_CHILD_ENV];
+  const reader = Bun.stdin.stream().getReader();
+  let finished = false;
   let result: ImportChildResult;
   try {
     const request = JSON.parse(
-      await new Response(Bun.stdin.stream()).text()
+      await readRequestLine(reader)
     ) as ImportChildRequest;
+    // The parent holds stdin open until it has our result; EOF before that
+    // means it died. Noticed between import steps.
+    void (async () => {
+      try {
+        while (!(await reader.read()).done) {
+          // nothing is written after the request
+        }
+      } catch {
+        // a broken pipe is the same as EOF
+      }
+      if (!finished) process.exit(1);
+    })();
     result = { ok: true, receipt: await importInThisProcess(request) };
   } catch (error) {
     result =
@@ -146,7 +212,9 @@ export async function runImportChild(): Promise<void> {
             message: error instanceof Error ? error.message : String(error),
           };
   }
+  finished = true;
   process.stdout.write(`${JSON.stringify(result)}\n`);
+  void reader.cancel().catch(() => undefined);
 }
 
 if (import.meta.main) await runImportChild();

package/src/store/migrations/035-vector-length-index.ts

@@ -0,0 +1,30 @@
+/**
+ * Migration: index stored vector byte lengths per model.
+ *
+ * Status checks the stored embedding dimensions for the active model by
+ * comparing the smallest and largest vector in its partition. Without an
+ * index that is a scan of every vector on each status build (about 0.6 ms
+ * per thousand vectors), run on the resident's main thread. With this
+ * covering index each bound is a single index seek.
+ *
+ * @module src/store/migrations/035-vector-length-index
+ */
+
+import type { Database } from "bun:sqlite";
+
+import type { Migration } from "./runner";
+
+export const migration: Migration = {
+  version: 35,
+  name: "vector_length_index",
+
+  up(db: Database): void {
+    db.exec(
+      "CREATE INDEX IF NOT EXISTS idx_vectors_model_bytes ON content_vectors(model, length(embedding))"
+    );
+  },
+
+  down(db: Database): void {
+    db.exec("DROP INDEX IF EXISTS idx_vectors_model_bytes");
+  },
+};

package/src/store/migrations/index.ts

@@ -48,6 +48,7 @@ import { migration as m031 } from "./031-runtime-independent-vectors";
 import { migration as m032 } from "./032-vector-runtime-callers";
 import { migration as m033 } from "./033-drop-documents-active-index";
 import { migration as m034 } from "./034-collection-link-workspace";
+import { migration as m035 } from "./035-vector-length-index";
 
 /** All migrations in order */
 export const migrations = [
@@ -85,4 +86,5 @@ export const migrations = [
   m032,
   m033,
   m034,
+  m035,
 ];

package/src/store/sqlite/adapter.ts

@@ -979,7 +979,10 @@ export class SqliteAdapter implements StorePort, SqliteDbProvider {
         }
       });
 
-      transaction();
+      // Read-then-write: take the write lock up front. A deferred transaction
+      // whose snapshot goes stale (another process commits meanwhile) fails at
+      // once with "database is locked" instead of waiting out the busy timeout.
+      transaction.immediate();
       return ok(undefined);
     } catch (cause) {
       return err(

package/src/store/vector/freshness.ts

@@ -35,14 +35,21 @@ export function getStoredEmbeddingDimensions(
     }
   }
   // Validate the entire model partition: never trust an arbitrary first blob.
-  const row = db
-    .prepare(`SELECT MIN(length(embedding)) AS smallest,
-    MAX(length(embedding)) AS largest FROM content_vectors WHERE model = ?`)
-    .get(model) as { smallest: number | null; largest: number | null };
-  const bytes = row.smallest;
+  // One aggregate per query so each bound is a seek on idx_vectors_model_bytes
+  // (MIN and MAX together would scan every vector), read in one transaction
+  // so both bounds see the same snapshot while another process writes.
+  const bound = (aggregate: "MIN" | "MAX"): number | null =>
+    (
+      db
+        .prepare(
+          `SELECT ${aggregate}(length(embedding)) AS bytes FROM content_vectors WHERE model = ?`
+        )
+        .get(model) as { bytes: number | null }
+    ).bytes;
+  const [bytes, largest] = db.transaction(() => [bound("MIN"), bound("MAX")])();
   if (
     !bytes ||
-    bytes !== row.largest ||
+    bytes !== largest ||
     bytes % Float32Array.BYTES_PER_ELEMENT !== 0
   ) {
     return undefined;

package/browser-extension/artifacts/gno-browser-clipper-v2.9.1.zip.sha256

@@ -1 +0,0 @@
-f58e51eea9d0b35a61ef55574882c4be8002ed2fdc29966a3cd1bd7c84350e3c  gno-browser-clipper-v2.9.1.zip